amazon-web-services - ELB 后面的 EKS 节点停止服务

Question

有一个 EKS 集群，该集群有一个 ELB 以及附加到它的 3 个工作节点。该应用程序在 30590 上的容器中运行。在同一端口 30590 上配置了健康检查。Kube-proxy 正在监听此端口。但是工作节点在 ELB 后面是 OutOfService。

1. 禁用工作节点的源、目标检查。
2. 通过“echo 0 | sudo tee/proc/sys/net/ipv4/conf/{all,eth0,eth1,eth2}/rp_filter”禁用 rp_filter
3. “sudo iptables -vL”的输出:

 pkts bytes target     prot opt in     out     source               destination         
13884  826K KUBE-EXTERNAL-SERVICES  all  --  any    any     anywhere             anywhere             ctstate NEW /* kubernetes externally-visible service portals */
2545K 1268M KUBE-FIREWALL  all  --  any    any     anywhere             anywhere            

Chain FORWARD (policy ACCEPT 92 packets, 28670 bytes)
 pkts bytes target     prot opt in     out     source               destination         
1307K  409M KUBE-FORWARD  all  --  any    any     anywhere             anywhere             /* kubernetes forwarding rules */
1301K  409M DOCKER-USER  all  --  any    any     anywhere             anywhere            

Chain OUTPUT (policy ACCEPT 139 packets, 12822 bytes)
 pkts bytes target     prot opt in     out     source               destination         
 349K   21M KUBE-SERVICES  all  --  any    any     anywhere             anywhere             ctstate NEW /* kubernetes service portals */
2443K  222M KUBE-FIREWALL  all  --  any    any     anywhere             anywhere            

Chain DOCKER (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  any    any     anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     all  --  any    any     anywhere             anywhere            

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
1301K  409M RETURN     all  --  any    any     anywhere             anywhere            

Chain KUBE-EXTERNAL-SERVICES (1 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain KUBE-FIREWALL (2 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  any    any     anywhere             anywhere             /* kubernetes firewall for dropping marked packets */ mark match 0x8000/0x8000

Chain KUBE-FORWARD (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    3   180 ACCEPT     all  --  any    any     anywhere             anywhere             /* kubernetes forwarding rules */ mark match 0x4000/0x4000

Chain KUBE-SERVICES (1 references)
 pkts bytes target     prot opt in     out     source               destination

1. 输出:sudo tcpdump -i eth0 port 30590

12:41:44.217236 IP ip-192-168-186-107.ec2.internal.22580 > ip-x-x-x-.ec2.internal.30590: Flags [S], seq 3790958206, win 29200, options [mss 1460,sackOK,TS val 10236779 ecr 0,nop,wscale 8], length 0
12:41:44.217834 IP ip-x-x-x-.ec2.internal.30590 > ip-192-168-186-107.ec2.internal.22580: Flags [R.], seq 0, ack 3790958207, win 0, length 0 

看起来 EKS 节点正在向 ELB 发送 TCP RST，因为这就是它们未能通过 ELB 健康检查的原因。谁能帮我排查问题？

Answer 1

找到解决方案:)问题出在 replicationcontroller.json 文件上，我提到了要公开的错误端口，并尝试连接到不同的端口。